Audit engagement risk is something all auditors think about and incorporate into their decisions, but recent research suggests that they might not be thinking about it as broadly as they should. 

To better understand audit litigation risks, we joined our colleagues in interviewing 39 very experienced audit litigators, including attorneys, trial consultants, and expert witnesses. These experts averaged 31 years of experience in audit litigation and provided us with a comprehensive perspective on trial preparation. Our study, published in “The Accounting Review,” was inspired by earlier work with litigators suggesting that auditors systematically underestimate audit litigation risk because they don’t adequately understand all the factors that can affect it.

Even when auditors follow all the standards and perform a high-quality audit, they can still be sued if a client or third parties believe they made a mistake. This includes honest errors, fraud that they didn’t catch, or misperception about what an audit actually covers. Even a squeaky-clean audit won’t immunize you from litigation, and there are several other factors that can affect the outcome of a case, many of which come into focus during trial preparation. 

So, it’s not enough to focus on audit quality — it’s also critical to focus on what would happen if your work were ever to go before a judge and jury.

Think like a litigator

Based on our research, the first thing you need to do is start thinking like a litigator and learn to think about your audits through a legal lens. The “Elaboration Likelihood Model” from psychology research provides a helpful way to think about this. 

ELM explains how people — including judges and juries — are persuaded, and it depends on how deeply they think about the information they’re given. “High elaboration” means jurors are thinking critically about the evidence and the facts of the case, while “low elaboration” means they’re going more with their gut feeling and emotions.

Here’s what our research found:

• Plaintiff attorneys prefer to keep things simple and emotional, encouraging low elaboration by jurors. They know that auditing standards are complex, and most jurors don’t have the background to understand them. They’ll often use arguments like, “This company lost millions of dollars. The auditor should have caught it.” This kind of argument preys on the misconception that many jurors have — that an audit is a guarantee of accuracy or future business success.
• Defense attorneys, in contrast, want jurors to use high elaboration. To achieve that, they need to spend a lot of time educating jurors about the technical details of auditing, the relevant standards, and what an auditor’s work actually showed. They essentially have to teach a crash course in auditing, which is difficult and time-consuming, and there’s no guarantee that it will work.

The venue and jury matter

The venue of the trial and the potential jury pool are also really important and are things that auditors can consider in advance. Our research found that:

• Federal courts tend to be more favorable to auditors than state courts because federal judges are usually more sophisticated and knowledgeable about business matters.
• Jurors with high levels of education and business experience are more likely to understand the technicalities of an audit and won’t be as swayed by emotional arguments. This means that if your client is headquartered in a city with a lot of college graduates and white-collar jobs, you’re less likely to face a runaway jury.
• Jurors with a strong hometown bias are unlikely objective, and are more likely to side with a local company over an outside audit firm. This hometown bias can be a real problem, especially for smaller firms.

What can auditors do?

So, what can auditors do about all of this? The good news is that our research suggests there are several steps you can take.

During client acceptance, firms should:

• Consider the potential trial venue and jury pool. It’s a little morbid to think about, but ask yourself, “If I were to be sued over this audit, where would the trial be held? What are the demographics and sophistication of the jury pool in that jurisdiction?” Auditors should incorporate these factors into their risk assessment and management processes. 

And during the audit, you should:

• Go beyond merely complying with auditing standards to minimize the possibility of errors or misstatements that could lead to litigation. This means taking a proactive approach to risk assessment and considering factors that might increase the likelihood of a lawsuit when planning an audit engagement, even if they aren’t explicitly required by the standards.
• Be clear about the scope of the audit and your responsibilities in your engagement letter and throughout the engagement. Make sure the client understands what you are doing, what you are not doing, and the limitations of an audit. Document all communications with the client and make sure your workpapers clearly reflect the work that was done.
• Write audit workpapers with potential litigation in mind. Use clear and concise language that a layperson could understand, and explain how your work meets the relevant auditing standards.

Beyond our findings, it’s also important to:

• Consider engaging with trial consultants to help you assess your litigation risk in different jurisdictions and develop strategies for dealing with different types of juries.
• Educate the public about auditing to dispel the common misconceptions about your role and responsibilities. The more people understand about what auditors do (and don’t do), the less likely they are to make unreasonable demands and file frivolous lawsuits.

By being aware of the legal context and planning ahead, you can better manage your litigation risk. This doesn’t mean you should drop clients with higher business risk, but it does mean you need to be aware of all the factors that can contribute to audit litigation risk and assess your ability to mitigate those risks. In doing so, you can continue to provide valuable services to your clients and protect the integrity of the financial reporting system.

The insights from our research make one thing abundantly clear: Focusing on compliance with auditing standards is not enough. To truly protect yourselves, your firms, and the investing public, auditors need to broaden their perspectives and develop a sophisticated understanding of the legal and social context in which they operate. 

This requires auditors to be more proactive, more communicative, and more willing to challenge the status quo. Ultimately, the future of the profession may depend on your ability to adapt to the changing legal landscape and embrace a more holistic view of audit risk.

Spreadsheet and data solutions provider Sourcetable launched a “self-driving” spreadsheet that allows users to simply tell the spreadsheet what they want done through natural language commands.

Sourcetable developed the solution as a way to bring advanced spreadsheet functionality to people who might struggle with basic functions like VLOOKUP or creating a pivot table. The “self-driving” autopilot capabilities give the AI complete write access and edit control to complete multi-step operations.

“AI is the biggest platform shift since the browser, with a bigger opportunity for disruption,” said Sourcetable CEO and co-founder Eoin McMillan. “Sourcetable is building the AI spreadsheet for the next billion users, be they human or AI. As AI makes analysis easier, everybody will become an analyst. Sourcetable’s AI automation ushers in a new era of productivity and human cognition.”

Summit Art Creations – stock.adobe.com

Sourcetable’s autopilot mode can complete a wide range of complex tasks, including creating and editing financial models, generating spreadsheet templates, building pivot tables, cleaning data, creating charts and graphs, editing formatting, enriching data and analyzing entire workbooks. The AI can understand data context without requiring users to pre-select ranges, interpret multiple ranges across different tabs, work with messy data, and seek human clarification when instructions are unclear.

The AI is capable of accessing anything that is publicly available on the internet, McMillan said in an email, and it can also extract data from URLs if instructed to do so. This includes Federal Reserve Economic Data, stock ticks and trading data, Yahoo finance, futures, geopolitics, market sentiment, macroeconomic analyses, Wikipedia data and much more. “There’s even a full fund manager Easter egg included in this release,” he added. 

This ability to access tools outside itself also means that users, via a virtual machine with hundreds of libraries and AI tools available, can ask the autopilot to find a more advanced tool to serve their needs by requesting the system to “download data” or “use Python” to solve a task. McMillan said Sourcetable plans to make this feature more user-friendly in the future as the technology ultimately moves toward becoming a full agentic platform and operating system. 

To discourage the AI from providing false information, the solution is built around a code-driven evaluation loop developed internally that verifies AI response in real time. Without this foundation, according to Sourcetable, self-driving spreadsheet automation would be too slow and unreliable to be trusted. McMillan said the company uses a combination of techniques to optimize results while minimizing latency. First, there’s AI-driven process supervision of inputs, outputs and prompts, effectively AI watching AI. This is combined with a code-driven audit of quantitative outputs (e.g., Python, SQL and spreadsheet output evaluation) and, finally, thought-driven techniques (e.g., Chain of Thought Reasoning and Deliberate Reasoning) to drive better results, particularly for multi-step processes. 

The new solution uses not one but many models to deliver results. While certain companies are locked into their own proprietary AI models, Sourcetable’s AI selects the optimal model for each task–including OpenAI, Anthropic, Groq, Meta (Llama), Nvidia, Prior Labs, DeepSeek and Hugging Face—and even combines multiple models for better results. McMillan explained that different models are better suited to different tasks and run better on different kinds of hardware. For example, he noted, Claude is currently best at coding, TabPFN at interpreting tabular data, Groq at fast inference, etc. Sourcetable’s AI knows model specifications and strengths, so i’s able to understand what a user is trying to do and find the best tool for it. 

While accessing public models can sometimes come with a per-prompt cost, McMillan said the company has established relationships with many service providers to ensure high rate limits and the ability to handle a large number of requests. He added that, right now, Sourcetable use a combination of manual and automated controls to prevent abuse of the system that could conceivably create large fees, though he believes the long-term cost curve indicates that AI will essentially become free, with the price of software being more aligned with value than cost of goods sold.

Prior to this release, Sourcetable did offer an AI copilot similar to many in the market that was more for formula assistance, charting and answering questions, according to McMillan. This was initially included as a SQL assistant to retrieve database data to help users who didn’t know how to write SQL, and this is how the company learned that users really wanted to use the AI for their regular spreadsheet workflows, leading Sourcetable to develop this current solution. 

“Ironically, solving the database retrieval problems forced us to build our own Chain of Thought equivalent before OpenAI released theirs publicly,” said McMillan. “That taught us how to leverage processes like CoT for multistep processes and automation, and this gave us a big head start once we shifted gears toward full spreadsheet automation via AI. Today’s autopilot moves us from answering questions to thinking and agency. It’s a big leap forward.”

Sourcetable offers both a free tier and a pro tier, which costs $20 a month. All Sourcetable users get the first two weeks free on the Pro tier and can continue using the system on a rate-limited free tier. All the regular spreadsheet and charting features are free and unrestricted. McMillan added that Pro users are Sourcetable’s revenue source. Free tier users generate no revenue, he said, “although happy users spread the word, which is the best form of marketing.”

The Internal Revenue Service’s Criminal Investigation unit has embarked on a new initiative for engaging with financial institutions as it makes greater use of banking data to uncover tax and financial fraud. 

IRS-CI released FY24 Bank Secrecy Act metrics Friday, demonstrating how it uses BSA data to investigate financial crimes. During fiscal years 2022 through 2024, 87.3% of IRS-CI’s criminal investigations recommended for prosecution had a primary subject with a related BSA filing, and adjudicated cases led to a 97.3% conviction rate, with defendants receiving average prison sentences of 37 months. IRS-CI also leveraged BSA data to identify $21.1 billion in fraud linked to tax and financial crimes, seize $8.2 billion in assets tied to criminal activity, and obtain $1.4 billion in restitution for crime victims.

Under the BSA, which Congress passed in 1970, financial institutions use suspicious activity reports to notify the federal government when they see instances of potential money laundering or tax evasion. The SARs data is used by agencies like IRS-CI to probe money laundering and related financial crimes.

A new IRS-CI initiative known as CI-FIRST (Feedback in Response to Strategic Threats) aims to establish ongoing engagement with financial institutions. They will receive quantifiable results from IRS-CI on how the agency uses suspicious activity reports to investigate federal crimes. 

“Public-private partnerships thrive when everyone mutually benefits, and to enhance our partnership with the financial industry, we plan to launch CI-FIRST which will promote information-sharing, streamline processes and demonstrate how valuable BSA data is to criminal investigations,” said IRS-CI Chief Guy Ficco in a statement.

As part of the CI-FIRST program, IRS-CI plans to streamline subpoena requests and share pointers with financial institutions on what to include in suspicious activity reports to maximize their impact. The program will address what’s working and what can be improved, offering continuous lines of communication between partners. IRS-CI headquarters will work with larger financial institutions that have a national and international presence, while its field office personnel will work with regional and community banks and credit unions.

IRS-CI special agents ran an average of 966,900 searches each year against currency transaction reports during the last three fiscal years. Close to 1,600 cases were opened in FY24 with at least one currency transaction report on the primary subject. The data also shows that 67.4% of cases opened by IRS-CI had a subject with one or more currency transaction reports below $40,000, with 50% of currency transaction reports involving amounts less than $22,230.

BSA data has also proven to be effective in helping IRS-CI combat narcotics trafficking and pandemic-era tax fraud. Since FY20, IRS-CI used BSA data to initiate nearly 1,300 investigations with ties to fentanyl and investigate alleged employee retention credit fraud totaling $5.5 billion.